Splunk Search

How can I find the reoccurring group of transactions over time?

RocIngersol
Explorer

Hey Folks,

I have a transaction search that "groups" various things of interest (5m maxspan etc ). I was wondering - how could I count the reoccurrences of transaction groups over time? Some sort of eval I guess but ain't sure....

thx,
R

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@RocIngersol - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post and upvote anything that was helpful. If no, please leave a comment with more feedback. Thanks.

0 Karma

woodcock
Esteemed Legend

Using transaction causes many metadata fields to be created including eventcount which is exactly what you need. Once the search completes, in the events area, to the left aligned with the the first line of each transaction, in the i column, you should see a > character. Click on this and it will become a v character. Then scroll down to the bottom of your event to see a wonderful land of insight showing each field/value that exists for this event, even the uninteresting ones.

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Can you give a specific example of what you would call a recurrence? That description or example is going to determine how you need to treat the data in order to be able to find that recurrence.

0 Karma

RocIngersol
Explorer

Sure, thx. So my transaction search runs and I get lots of "grouped events" by my criteria and max span etc. So while that's valuable I want to count the occurrences of each transaction group over time. I tried building a new field after transaction with eval newIDfield=field1+field2 But that results in some newIDfield being blank when there are multiple different values for field1 out of the transaction..

Hope that is clearer! I'll post my search when I'm online later if not.

R

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

The search itself would help. The main question is, how do you (as a data consumer) know that a later transaction is a recurrence of an earlier one, as opposed to a closely similar but different transaction?

0 Karma

woodcock
Esteemed Legend

You probably need timechart, maybe ... | timechart count BY host added to your existing search.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...